Wireshark EUVD-2026-63175

The user must actively open or initiate processing of a crafted packet capture file (e.g., .pcap, .pcapng) or receive malformed AVRCP packets during a live Bluetooth capture session within Wireshark. The CVSS vector UI:R explicitly requires this user interaction - the vulnerability cannot be triggered passively or remotely without the user's action. The Bluetooth AVRCP dissector must be enabled (it is enabled by default in standard Wireshark installations). Exploitation is limited to denial of service (crash) only; CVSS C:N/I:N rules out confidentiality or integrity compromise. Affected versions are strictly 4.6.0-4.6.7 and 4.4.0-4.4.18; versions outside these ranges are not confirmed affected. No authentication or elevated privileges are required to run Wireshark and trigger the crash, but physical or social access to deliver the malicious file is required.

Real-world risk is moderate-to-low. The CVSS 5.5 score reflects the constrained attack surface: AV:L and UI:R together mean an attacker must deliver a malicious capture file and convince a user to open it - ruling out unauthenticated remote exploitation. The impact is limited to availability (A:H, crash/DoS); confidentiality and integrity are unaffected (C:N/I:N), so there is no code execution or data exfiltration path evident from available data. EPSS data was not provided, but the profile of a UI:R dissector crash historically maps to low exploitation probability in practice. No KEV listing and no public exploit code reduce urgency further. The primary realistic threat is targeted delivery of a malicious pcap to a security analyst or network engineer - social engineering rather than opportunistic mass exploitation. The flaw is nonetheless worth patching promptly in environments where analysts open untrusted capture files, which is common in incident response and threat hunting workflows.

An attacker crafts a .pcapng file containing malformed Bluetooth AVRCP packets designed to trigger the heap overflow in Wireshark's dissector. The file is delivered to a security analyst or network engineer via email attachment or file share under a plausible pretext (e.g., a 'suspicious Bluetooth capture for analysis'). When the analyst opens the file in a vulnerable Wireshark version, the AVRCP dissector crashes the application, causing denial of service and loss of any unsaved capture session state. No public POC has been confirmed at time of analysis.